loading
Loading content
loading
Scanners
CVE-2025-14847 MongoDB memory disclosure scanner.
overview
mongobleed tests MongoDB listeners for CVE-2025-14847. It sends crafted OP_COMPRESSED packets, watches for leaked memory in the response, and flags hosts that bleed data. The check follows Joe Desimone's published exploit technique.
Feed --input a file of hosts in host, host:port, http(s), or mongodb URI form. Raise --concurrency for wide estates. --quiet prints only vulnerable hits; --verbose adds leaked-memory samples so you can confirm a finding before you escalate.
Place it after port discovery so only confirmed MongoDB listeners are tested. Prefer mongobleed for this single flaw; use nuclei when you need a multi-CVE template pack on the same host list.
use cases
Run mongobleed against hosts found listening on MongoDB ports to confirm which ones leak memory through the OP_COMPRESSED flaw.
Raise --concurrency to scan hundreds of hosts at once and use --quiet so the output lists only the vulnerable targets that need action.
Enable --verbose to print samples of the disclosed memory, turning a yes/no result into evidence you can include in a report.
Feed mongobleed the MongoDB hosts from naabu or masscan so the vulnerability check only touches services already confirmed open.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | --input | File of targets, one per line; supports host, host:port, http(s)://host:port, and mongodb://host:port. |
| concurrency | STRING | --concurrency | Number of concurrent connections (default 200). |
| timeout | STRING | --timeout | Connection timeout in seconds (default 5). |
| quiet | BOOLEAN | --quiet | Quiet mode, show only vulnerable hosts. |
| verbose | BOOLEAN | --verbose | Verbose output with leaked data samples. |
| doc-len | STRING | --doc-len | BSON document length for the exploit (default 100). |
| buffer-size | STRING | --buffer-size | Inflated buffer size to trigger the leak (default 600). |
| all-results | BOOLEAN | --all-results | Include all results in output, not only vulnerable hosts. |
Showing key inputs. mongobleed exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | --input | File containing targets (one per line, supports: host, host:port, http://host:port, https://host:port, mongodb://host:port) |
| quiet | BOOLEAN | --quiet | Quiet mode (only show vulnerable hosts) |
| doc-len | STRING | --doc-len | BSON document length for exploit (default 100) |
| timeout | STRING | --timeout | Connection timeout in seconds (default 5) |
| verbose | BOOLEAN | --verbose | Enable verbose output with leaked data samples |
| no-color | BOOLEAN | --no-color | Disable colored output |
| all-results | BOOLEAN | --all-results | Include all results in output (not only vulnerable) |
| buffer-size | STRING | --buffer-size | Inflated buffer size to trigger leak (default 600) |
| concurrency | STRING | --concurrency | Number of concurrent connections (default 200) |
example
# quiet scan of MongoDB targets for CVE-2025-14847mongobleed --input mongo-hosts.txt --quiet --concurrency 200 --timeout 5198.51.100.10:27017 VULNERABLE203.0.113.25:27017 VULNERABLE192.0.2.40:27017 not vulnerablemongo.dev.example.com:27017 VULNERABLEdb.staging.example.com:27017 not vulnerable198.51.100.88:27017 VULNERABLEapi.example.com:27017 not vulnerableguidance
Reach for mongobleed when you already have MongoDB hosts and need a CVE-2025-14847 yes or no. It is not a discovery scanner. Feed a target list from a port scan, then use --quiet to surface only hosts that leak.
Template-driven scanner covering many CVEs. mongobleed stays purpose-built for this one OP_COMPRESSED memory disclosure check.
Port scanner that finds MongoDB listeners to feed mongobleed. Run them in sequence, not as substitutes.
Same check wrapped for larger target sets when you need batch orchestration around the core scanner.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
A host list feeds naabu to find open MongoDB ports, then mongobleed tests those hosts for CVE-2025-14847 and writes the vulnerable ones as a queryable output.
Facts on this page come from the live Trickest tool library.